CVE-2025-59106
Web Server Running with Root Privileges in dormakaba access manager
- State
- Published
- Severity
- 8.8 High
- Published
- Jan 26, 2026
- Updated
- Jan 27, 2026
- Reserved
- Sep 9, 2025
Description
The binary serving the web server and executing basically all actions launched from the Web UI is running with root privileges. This is against the least privilege principle. If an attacker is able to execute code on the system via other vulnerabilities it is possible to directly execute commands with highest privileges.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | CISA-ADP |
Weaknesses
- CWE-272 Least Privilege Violation
Affected Products
| Product | Versions |
|---|---|
Access Manager 92xx-k7dormakaba |
|
References
- https://r.sec-consult.com/dormakabatechnical-description
- https://r.sec-consult.com/dkaccessthird-party-advisory
- https://www.dormakabagroup.com/en/security-advisoriesvendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.